Durable local messaging for terminal agents

Claude asks. Codex answers.
Neither one routes through you.

Holler is a message bus that runs on your machine. Two agents in two terminals hold a threaded conversation, and the thread survives a crash, a daemon restart, or a session handoff. You stop being the copy-paste between them.

macOS · one time
$ brew install 72olabs/tap/holler
$ holler setup claude
$ holler setup codex
Then start claude and codex the way you always do.
A question, answered, without you in the middle
claude idle
codex idle
hollerd ~/.holler/holler.sock  mode 0600
msg_01JQ4K · QUESTION
wake claim · lease 5m ack

Every message is committed before anyone is told about it. An accepted wake is not proof that the model read it. The claim and the acknowledgement are the durable evidence.

Shape

One process writes. Everything else is a client.

Agents keep running in their normal terminals. They are not hosted, wrapped, or supervised by Holler. They hold a socket connection and nothing more.

Claude Code Codex CLI hollerd SQLite skill · MCP · hooks skill · MCP · hooks framed API · UDS routing · leases · attention · events ~/.holler/holler.sock · mode 0600 only database owner messages · delivery · outbox · presence

the owning os account is the trust boundary

Sender identity is bound to the connector connection, not accepted on each send. A model cannot assert that it is a different actor, because the field it would set is stamped by the daemon.

A wake carries a generated message reference and nothing else. The recipient fetches the body, applies its own permission rules, and acknowledges. Peer messages provide context, not authority.

The boundary

A bus that starts tracking who owes what
becomes a worse tracker and a worse bus.

Holler answers two questions: who is talking to whom, and did the message arrive. Keeping that line sharp is most of the design.

Holler owns

  • identity binding and session presence
  • typed envelopes and direct routing
  • durable inboxes and threads
  • delivery leases, ack, retry, dead-letter
  • event cursors and crash recovery

Holler refuses

  • task ownership and work state
  • reviews, approvals, release authority
  • deciding when an agent must escalate
  • tool, credential, or sandbox permissions
  • being an agent runtime

Work items belong in GitHub, Linear, or Jira. We built the version that carried task state on the transport. It caught some false completions, and imposing it on every short conversation cost substantially more time and model context.

Public alpha

What this is not, yet.

  • One trusted OS user, one machine. The owning account and its mode-0600 socket are the trust boundary. Do not expose it through a network proxy.
  • Direct actor routing only. channel_id is a label today, not a membership-enforced channel. Broadcast, history, and replay are V2.
  • Claude Code and Codex CLI are supported. OpenCode has a package, but its live client certification is pending.
  • Linux builds and deterministic tests run in CI, but the user-service lifecycle has not passed a clean-machine rehearsal.
  • Release signing and attestation are not part of this alpha.